korean-privacy-terms
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to execute logic from the
@nomadamas/k-skillnpm package vianpxand runsscripts/install.sh, which performs shell operations and repository cloning. - [EXTERNAL_DOWNLOADS]: The
scripts/install.shscript clones a remote repository fromgithub.com/kimlawtech/korean-privacy-termsduring the installation phase. - [PERSISTENCE]: The skill modifies
~/.claude/skills/and~/.agents/skills/directories, which are standard paths for agent skill discovery and execution, to install and update "upstream" components. - [DYNAMIC_EXECUTION]: The skill generates React/Next.js components and MDX files at runtime based on templates and user-supplied information.
- [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: User input collected during the "Mandatory interview" phase (e.g., service details, business information) as defined in
instruction.md. 2. Boundary markers: The instructions require the inclusion of legal disclaimer comments in the generated output files. 3. Capability inventory: The skill utilizesgit,rsync,cp, andnpxto fetch and deploy files, and performs file-write operations within the project directory. 4. Sanitization: No explicit sanitization or escaping of user-provided information is mentioned before it is interpolated into the generated code files.
Audit Metadata